STIGQter STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must audit request and response details (such as method, URL, headers, body, status, etc.).

DISA Rule

SV-274534r1143565_rule

Vulnerability Number

V-274534

Group Title

SRG-APP-000095

Rule Version

SRG-APP-000095-API-001795

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Build or configure the API to log the necessary request and response details such as method, URL, headers, body, status, etc.

Check Contents

Verify the API audits request and response details.

1. Inspect the API's logs to verify they capture details of incoming requests and outgoing responses, including headers, body content, and status codes.

2. Simulate various requests and verify that both request and response details are being logged correctly, including any data passed and the response outcome.

3. Verify the API is configured to log the necessary request and response details, such as the type of request, request parameters, and response status.

4. Review the API's documentation to ensure proper auditing of request and response details is enabled.

If the API is not auditing request and response detail, this is a finding.

Vulnerability Number

V-274534

Documentable

False

Rule Version

SRG-APP-000095-API-001795

Severity Override Guidance

Verify the API audits request and response details.

1. Inspect the API's logs to verify they capture details of incoming requests and outgoing responses, including headers, body content, and status codes.

2. Simulate various requests and verify that both request and response details are being logged correctly, including any data passed and the response outcome.

3. Verify the API is configured to log the necessary request and response details, such as the type of request, request parameters, and response status.

4. Review the API's documentation to ensure proper auditing of request and response details is enabled.

If the API is not auditing request and response detail, this is a finding.

Check Content Reference

M

Target Key

5703